CVE-2026-12762

MEDIUM

Insertion of Sensitive Information into Externally-Accessible File in IBM Business Automation Insights

Title source: cna
STIX 2.1

Description

IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information exposed in manifest files.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory patch
https://www.ibm.com/support/pages/node/7282605

Scores

CVSS v3 5.3
EPSS 0.0024
EPSS Percentile 15.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-538
Status published
Products (8)
ibm/business_automation_insights 24.0.0 (8 CPE variants)
ibm/business_automation_insights 24.0.1 (8 CPE variants)
ibm/business_automation_insights 25.0.0 (6 CPE variants)
ibm/business_automation_insights 26.0.0
IBM/Cloud Pak For Business Automation 24.0.0
IBM/Cloud Pak For Business Automation 24.0.1
IBM/Cloud Pak For Business Automation 25.0.0
IBM/Cloud Pak For Business Automation 26.0.0
Published Aug 05, 2026
Tracked Since Aug 05, 2026